With the advent of personal computer system use in every day business transactions, the issue of computer security has become critical. Unsecured personal computers inhibit electronic business (e-business) because users are reluctant, justifiably so, to transmit highly personal and sensitive information to system which may be vulnerable to intruders or viruses. While many personal computer (PC) manufacturers have made individual strides towards increasing security by adding “smart cards” or embedded security chips to their new models, the lack of a concerted effort by the PC industry to develop security technology could prevent the evolution of this technology in a consistent and compatible way between manufacturers.
Recognizing this potential risk and the adverse effects it could have on inhibiting electronic commerce, an open alliance between major PC manufacturers was formed to develop and propose a standard that would adopt hardware and software technologies to strengthen security at the platform level. The open alliance, known as the Trusted Computing Platform Alliance (TCPA), has proposed a standard including new hardware, BIOS and operating system specifications so PC manufacturers can provide a more trusted and secure PC platform based on common industry standards, the details of which are provided in the TCPA PC Specific Implementation Specification, 1.00 RC1 (Aug. 16, 2001), hereby incorporated by reference.
FIG. 1 is a block diagram illustrating a trusted platform in accordance with TCPA standards. As is shown, the PC architecture includes a system 10, platform 20, motherboard or planar 30, and trusted building block (TBB) 40. The system 10 includes the platform 20 and all post-boot components 12, including an operating system 14, that comprise the entire entity that performs actions for, or acts on behalf of, a user. The platform 20 presents and receives information to and from the user. The platform 20 includes the motherboard 30 and peripherals 22 attached to motherboard 30.
The motherboard 30 is provided by the manufacturer and includes one or more CPUs 32 and all primary peripheral devices 34, i.e., devices which directly attach to and directly interact with the CPU 32. In addition, the motherboard 30 includes all BIOSes 36 and the TBB 40. The TBB 40 is the center of the trusted platform, and includes a Core Root of Trust for Measurement (CRTM) 42, a Trusted Platform Module (TPM) 44, and a trusted connection 46 of the CRTM 42 and TPM 44 to the motherboard 30.
According to the TCPA specification, the CRTM 42 and the TPM 44 are the only trusted components on the motherboard 30, i.e., they are presumably secure and isolated from tampering by a third party vendor or software. Only the authorized platform manufacturer (or agent thereof) can update or modify code contained therein. The CRTM 42 is the executable component of the TBB 40 that gains control of the platform 20 upon a platform reset. Thus, for all types of platform resets, the CPU 32 always begins executing code with the CRTM's 42 platform initialization code. The trust in the platform is based on the CRTM 42, and trust in all measurements is based on its integrity.
The basic premise underlying the trusted platform is ensuring that untrusted devices or software have not been loaded onto the system. Trust is established during a pre-boot state that is initiated by a platform reset. The platform reset can either be a cold boot (power-on), a hardware reset, or a warm boot typically caused by a user keyboard input. Following a platform reset, the CPU 32 executes code with the CRTM's 42 platform initialization code. The chain of trust begins at the CRTM 42.
In this architecture, the BIOS includes a Boot Block 50 and a POST BIOS 36. The Boot Block 50 and the POST BIOS 36 are independent components and each can be updated independent of the other. The Boot Block 50 is located in the CRTM 42, while the POST BIOS 36 is located outside the TBB 40. Thus, while the manufacturer or a third party supplier may update, modify or maintain the POST BIOS 36, only the manufacturer can modify or update the Boot Block 50. In a variation of the architecture, the entire BIOS is a single entity located entirely within the CRTM 42.
As stated above, the CRTM 42 and TPM 44 are presumptively trusted. Thus, following a platform reset, code in the Boot Block 50 is executed, which measures the entity to which it will transfer control, in this case, the Post BIOS 36. “Measuring an entity” means hashing code in the entity to produce a log of the code, which is then extended into a platform configuration register (PCR) 48 in the TPM 44. The TPM 44 includes a plurality of PCRs 48a, 48b, 48c, and 48d, a portion of which are designated to the pre-boot environment and referred to collectively as boot PCRs 48a. Each boot PCR 48a is dedicated to collecting specific information related to a particular stage of a boot sequence. For example one boot PCR 48a (PCR[0]) stores measurements from the CRTM 42, POST BIOS 36, and all firmware 38 physically bound to the motherboard 30.
Once the POST BIOS 36 has been measured, control is transferred to the POST BIOS 36, which then continues to boot the system by ensuring that hardware devices are functional. Once POST BIOS 36 gains control, it is responsible for measuring any entity to which it will transfer control. As the POST BIOS 36 progresses through the boot sequence, values in the boot PCRs 48a increment whenever an entity is measured.
Upon booting to the operating system (OS) 14, the operating system 14 verifies the trustworthiness of the platform 20 by comparing the values in the boot PCRs 48a with precalculated values known by the operating system 14. If the values match, the operating system 14 is assured of a secure boot and that the platform is trusted. If the values do not match, the operating system 14 is alerted of a possible breach, and the operating system 14 can take measures to reestablish trust.
In FIGS. 2A and 2B, a flowchart illustrating a conventional boot sequence 100 in accordance with the TCPA trust model is presented. The process 100 begins when the platform 20 is reset in step 110, e.g., the computer is powered-up. In step 112, all boot PCRs 48a are reset to zero. Before the code in the Boot Block 50 is executed, the code may be measured, i.e., hashed to produce a log, which is then extended to the appropriate boot PCR 48a, via step 114. Then, in step 116, the code in the Boot Block 50 is run, which passes control over to the POST BIOS 36. Nevertheless, before executing the code in the POST BIOS 36, that code is also hashed and extended to the boot PCR 48a in step 118. Then, in step 120, the code in the POST BIOS 36 is run.
Referring now to FIG. 2B, the process 100 continues at number B. The POST BIOS 36 locates any bootable devices in step 121 by reading each bootable device and attempting to find a valid boot record. When a valid boot record is discovered, the POST BIOS 36 measures the device and extends the value to the boot PCR 48a in step 122. Thereafter, in step 124, the code in the device is run. If this code determines that the boot is not a bootable device in step 126, control is then returned to the POST BIOS 36 to continue the booting sequence, via step 130.
If the device is a bootable device (step 126), an operating system 14 has presumably been booted, and the process 100 continues at number C. This part of the process verifies the trustworthiness of the boot sequence. As explained above, each component is measured, i.e., the code in each device is hashed and extended to the appropriate boot PCR 48a. Thus, the values in the boot PCRs 48 reflect the boot sequence from beginning to end. In step 134, the operating system compares the value in each boot PCR 48a to a precalculated value that reflects a trustworthy boot sequence. The precalculated value is typically calculated by the operating system 14, which is aware of all trusted components.
If the boot PCR 48 values are equal to the precalculated value calculated by the operating system 14 (step 136), the boot sequence finishes in step 138. On the other hand, if the boot PCR 48 values are not equal to the precalculated value calculated by the operating system 14 (step 136), the operating system 14 will initiate operations to restore trust in step 140. The operating system 14 may examine the boot process to determine whether a security breach has occurred, for instance, by launching a virus detection program.
While the TCPA compliant system described above ensures that rogue applications or devices do not contaminate the trusted platform, there is no present protection against a physical intrusion, i.e., an intruder removing the physical casing or cover of the computer system and physically tampering with the system. Typically, most computer systems utilize tamper circuits to detect a tamper event, e.g., removal of the cover. The tamper event triggers a response from the system, such as an alert to the administrator or a shut down during booting. Nevertheless, these measures can be avoided if the intruder boots to a non-system operating system, which can clear any indication that a tamper event occurred.
Accordingly, a need exists for a method and system for detecting a tamper event in a TCPA compliant system. The detection method and system should be secure and private so that a non-TCPA operating system cannot clear the tamper signal. The present invention addresses such a need.